How to check security defaults in Microsoft Entra ID

Before you start

Use an account in the Global Reader role, which can read everything a Global Administrator can and change nothing. Turning security defaults on or off needs at least Conditional Access Administrator. The PowerShell example requests Policy.Read.All; your organisation may require administrator consent.

Know what the setting covers. Security defaults make every user register for MFA, require MFA for administrators and for other users when Microsoft judges it necessary, block legacy authentication and device code flow, and protect Azure management. They need no licence. The examples read the setting; they don't change it.

Option 1

Check security defaults with PowerShell

Install the modules once, then connect, read the setting and save it with the tenant ID and the time.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
try {
    $defaults = Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy
    $report = [pscustomobject]@{
        TenantId                = (Get-MgContext).TenantId
        SecurityDefaultsEnabled = $defaults.IsEnabled
        CheckedUtc              = (Get-Date).ToUniversalTime()
    }
    $report | Export-Csv -Path './security-defaults.csv' -NoTypeInformation -Encoding utf8
    if ($defaults.IsEnabled) {
        Write-Output 'Security defaults are enabled.'
    } else {
        Write-Output 'Security defaults are disabled. Check that Conditional Access requires MFA.'
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV holds 1 row: the tenant, the setting and when you read it, so a monthly check builds a record. Add -Append to Export-Csv to keep every check in the same file.

See which Conditional Access policies are on

When security defaults are off, these are the policies doing their job. Reconnect with Connect-MgGraph, then list them.

# Run while connected to Microsoft Graph.
Get-MgIdentityConditionalAccessPolicy -All | Where-Object { $_.State -eq 'enabled' } |
    Select-Object DisplayName, State, ModifiedDateTime

An empty list with security defaults off means no Conditional Access policy is enforcing anything at sign-in.

Option 2

Check security defaults in the admin centre

1. Sign in to the Microsoft Entra admin centre for the correct tenant.
2. Go to Entra ID > Overview > Properties.
3. Select Manage security defaults and read Security defaults: Enabled, or Disabled (not recommended).
4. Close the pane without saving.

This suits a quick look at 1 tenant. For a dated record, or a check every month, use PowerShell or a report.

Common questions

Can I use security defaults and Conditional Access together?

No. To use Conditional Access policies, turn security defaults off, then turn on policies that keep the same protection. Microsoft-managed policies cover blocking legacy authentication and requiring MFA for administrators, for Azure management and for all users. Conditional Access needs Microsoft Entra ID P1.

Who is left out of security defaults?

The Microsoft Entra Connect and Cloud Sync synchronisation accounts, and anything in the Directory Synchronization Accounts role, aren't asked to register for or use MFA. Guests are treated the same as your own users.

Why does the per-user MFA page show everyone as Disabled?

That's expected. Disabled is the right status for users covered by security defaults or by Conditional Access. To see who has a method registered, see how to find users without MFA.